Report - updatedequitosfridayyyyMPDW-constraints.vbs

Generic Malware Antivirus Hide_URL PowerShell
ScreenShot
Created 2024.08.13 17:17 Machine s1_win7_x6403
Filename updatedequitosfridayyyyMPDW-constraints.vbs
Type Little-endian UTF-16 Unicode text, with very long lines, with CRLF, CR line terminators
AI Score Not founds Behavior Score
7.8
ZERO API file : mailcious
VT API (file)
md5 3443ed347a3f74c89d2deda980d47522
sha256 20a9c95337e5afa33fe7d8dba4f3bdc5bfb241ec3e023aa2e6556ae2020e0fa4
ssdeep 1536:MkLcccOgt5pz2UGwQ0kcVUJW4Wrle/PhG+/kery+bG8:Xgt5pzGwQ0kcdS7b
imphash
impfuzzy
  Network IP location

Signature (18cnts)

Level Description
danger The processes wscript.exe
watch Communicates with host for which no DNS query was performed
watch Creates a suspicious Powershell process
watch Network communications indicative of a potential document or script payload download was initiated by the process powershell.exe
watch One or more non-whitelisted processes were created
notice A process created a hidden window
notice Allocates read-write-execute memory (usually to unpack itself)
notice Checks adapter addresses which can be used to detect virtual network interfaces
notice Checks for the Locally Unique Identifier on the system for a suspicious privilege
notice Creates a shortcut to an executable file
notice Creates a suspicious process
notice Poweshell is sending data to a remote host
notice URL downloaded by powershell script
info Checks amount of memory in system
info Checks if process is being debugged by a debugger
info Command line console output was observed
info Queries for the computername
info Uses Windows APIs to generate a cryptographic key

Rules (5cnts)

Level Name Description Collection
warning Generic_Malware_Zero Generic Malware binaries (download)
watch Antivirus Contains references to security software binaries (download)
notice hide_url_link Hide url link scripts
info PowerShell PowerShell script scripts
info PowershellDI Extract Download/Invoke calls from powershell script scripts

Network (3cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
ia803104.us.archive.org US INTERNET-ARCHIVE 207.241.232.154 malware
207.241.232.154 US INTERNET-ARCHIVE 207.241.232.154 malware
104.21.67.152 US CLOUDFLARENET 104.21.67.152 clean

Suricata ids



Similarity measure (PE file only) - Checking for service failure